<html>
<head><meta charset="utf-8"><title>FFI &quot;change behavior or protect the caller&quot; · project-ffi-unwind · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/index.html">project-ffi-unwind</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html">FFI &quot;change behavior or protect the caller&quot;</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="180783324"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180783324" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> BatmanAoD (Kyle Strand) <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180783324">(Nov 14 2019 at 22:38)</a>:</h4>
<p><span class="user-mention" data-user-id="126931">@centril</span> moving the "FFI is not a sandbox" conversation here</p>



<a name="180783428"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180783428" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> BatmanAoD (Kyle Strand) <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180783428">(Nov 14 2019 at 22:39)</a>:</h4>
<p>Here's the way I formulated the "not supposed to change behavior or protect the caller" idea in my conversation earlier:</p>
<ul>
<li>FFI (in any language) should not protect the user from well-defined parts of the ABI being used, <em>even if</em> those parts of the ABI are "problematic" in some way (as exceptions arguably are), <em>but</em>...</li>
<li>Protecting the user from undefined behavior is part of Rust's core values, and FFI is not <em>inherently</em> an opt-out from that protection.</li>
</ul>



<a name="180783499"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180783499" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> BatmanAoD (Kyle Strand) <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180783499">(Nov 14 2019 at 22:40)</a>:</h4>
<p>I agree these are still not really fully-fleshed-out opinions, let alone statements of fact.</p>



<a name="180783534"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180783534" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> centril <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180783534">(Nov 14 2019 at 22:40)</a>:</h4>
<p>Well they are statements, but without justification ^^</p>



<a name="180783537"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180783537" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> BatmanAoD (Kyle Strand) <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180783537">(Nov 14 2019 at 22:40)</a>:</h4>
<p>But I would say that they "sound right"  to me.</p>



<a name="180783586"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180783586" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> BatmanAoD (Kyle Strand) <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180783586">(Nov 14 2019 at 22:41)</a>:</h4>
<p>Do you have specific objections to either claim, or do you just want to see a justification before deciding whether or not you agree?</p>



<a name="180783722"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180783722" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> centril <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180783722">(Nov 14 2019 at 22:43)</a>:</h4>
<p>I think those are too coarse statements and not sufficiently nuanced</p>



<a name="180783770"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180783770" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> centril <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180783770">(Nov 14 2019 at 22:43)</a>:</h4>
<p>splitting ABIs, adding shims, etc. is in my view perfectly legitimate in the interest of e.g. soundness, perf, etc.</p>



<a name="180783822"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180783822" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> BatmanAoD (Kyle Strand) <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180783822">(Nov 14 2019 at 22:44)</a>:</h4>
<p>So, "soundness" is covered in the second bullet point.</p>



<a name="180783837"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180783837" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> BatmanAoD (Kyle Strand) <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180783837">(Nov 14 2019 at 22:44)</a>:</h4>
<p>I'm not sure I see how shims could ever _improve_ performance.</p>



<a name="180783854"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180783854" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> centril <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180783854">(Nov 14 2019 at 22:44)</a>:</h4>
<p>Didn't feel that way to me but ok</p>



<a name="180783859"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180783859" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> BatmanAoD (Kyle Strand) <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180783859">(Nov 14 2019 at 22:44)</a>:</h4>
<p>But that's certainly an aspect of the question I hadn't even considered.</p>



<a name="180783930"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180783930" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> centril <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180783930">(Nov 14 2019 at 22:45)</a>:</h4>
<p><span class="user-mention" data-user-id="120076">@Kyle Strand</span>  well the nounwind assumption would, but it wouldn't ostensibly cover "the whole ABI"</p>



<a name="180783950"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180783950" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> BatmanAoD (Kyle Strand) <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180783950">(Nov 14 2019 at 22:45)</a>:</h4>
<p>nounwind isn't really a "shim", though, is it?</p>



<a name="180784025"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180784025" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> BatmanAoD (Kyle Strand) <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180784025">(Nov 14 2019 at 22:46)</a>:</h4>
<p>Re: soundness, could you suggest an alternate phrasing of the second bullet point that does make it clear?</p>



<a name="180784030"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180784030" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> centril <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180784030">(Nov 14 2019 at 22:46)</a>:</h4>
<p><span class="user-mention" data-user-id="120076">@Kyle Strand</span> not sure why you are linking perf and shims</p>



<a name="180784040"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180784040" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> centril <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180784040">(Nov 14 2019 at 22:46)</a>:</h4>
<p>(I didn't)</p>



<a name="180784118"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180784118" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> centril <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180784118">(Nov 14 2019 at 22:47)</a>:</h4>
<blockquote>
<p>Protecting the user from undefined behavior (e.g. via an abort shim, in case you mess up) and maintaining soundness is part of Rust's core values, and FFI is not inherently an opt-out from that protection.</p>
</blockquote>



<a name="180784130"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180784130" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> BatmanAoD (Kyle Strand) <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180784130">(Nov 14 2019 at 22:47)</a>:</h4>
<p>"Splitting ABIs, adding shims, etc ... perf, etc" </p>
<p>Was the performance consideration only meant to apply to "splitting ABIs", then?</p>



<a name="180784149"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180784149" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> centril <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180784149">(Nov 14 2019 at 22:47)</a>:</h4>
<p>sure; nounwind &amp; friends</p>



<a name="180784247"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180784247" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> BatmanAoD (Kyle Strand) <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180784247">(Nov 14 2019 at 22:48)</a>:</h4>
<p>Okay. My first impulse is to say that that's not really subject to the "not a sandbox" objection.</p>



<a name="180784305"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180784305" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> BatmanAoD (Kyle Strand) <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180784305">(Nov 14 2019 at 22:49)</a>:</h4>
<p>Isn't "maintaining soundness" covered by "protecting the user from undefined behavior"?</p>



<a name="180784313"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180784313" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> BatmanAoD (Kyle Strand) <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180784313">(Nov 14 2019 at 22:49)</a>:</h4>
<p>or implied by, rather</p>



<a name="180784323"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180784323" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> centril <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180784323">(Nov 14 2019 at 22:49)</a>:</h4>
<p>depends on whether you are talking about the safe or unsafe fragment</p>



<a name="180784390"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180784390" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> BatmanAoD (Kyle Strand) <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180784390">(Nov 14 2019 at 22:50)</a>:</h4>
<p>I'm a bit lost. "unsafe fragment"?</p>



<a name="180784435"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180784435" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> centril <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180784435">(Nov 14 2019 at 22:50)</a>:</h4>
<p>the abort shim protects you from UB even in unsafe code; but it also maintains soundness</p>



<a name="180784485"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180784485" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> centril <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180784485">(Nov 14 2019 at 22:51)</a>:</h4>
<p>one could ostensibly not have that shim for unsafe code, or only for unsafe code</p>



<a name="180784514"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180784514" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> centril <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180784514">(Nov 14 2019 at 22:51)</a>:</h4>
<p><span class="user-mention" data-user-id="120076">@Kyle Strand</span> either case, the soundness/UB point does poke a hole in "not a sandbox" pretty well</p>



<a name="180784601"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180784601" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> BatmanAoD (Kyle Strand) <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180784601">(Nov 14 2019 at 22:52)</a>:</h4>
<p>Yeah, that's why I'm trying to reformulate the objection without using the word "sandbox"; it's far too vague.</p>



<a name="180784651"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180784651" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> BatmanAoD (Kyle Strand) <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180784651">(Nov 14 2019 at 22:53)</a>:</h4>
<p>It's a metaphor that I believe helped me understand Nick's concern, but I fully agree it's not adequate!</p>



<a name="180784667"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180784667" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> BatmanAoD (Kyle Strand) <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180784667">(Nov 14 2019 at 22:53)</a>:</h4>
<p>But I think the first point stands:</p>



<a name="180784778"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180784778" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> BatmanAoD (Kyle Strand) <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180784778">(Nov 14 2019 at 22:54)</a>:</h4>
<p>_If_ it is true that exceptions are a well-defined part of an ABI, then I would agree with Nick that it's not a good idea to change the semantics of functions that <code>throw</code> by changing their ABI strings when calling them from Rust.</p>



<a name="180784789"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180784789" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> centril <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180784789">(Nov 14 2019 at 22:54)</a>:</h4>
<p>"in any language" makes the claim also extraordinarily strong -- maybe one of these languages can't even make full use of the ABI representable without a lot of cost</p>



<a name="180784836"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180784836" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> BatmanAoD (Kyle Strand) <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180784836">(Nov 14 2019 at 22:55)</a>:</h4>
<p>...then it shouldn't expose that ABI.</p>



<a name="180784938"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180784938" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> BatmanAoD (Kyle Strand) <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180784938">(Nov 14 2019 at 22:56)</a>:</h4>
<p>The negative way to phrase it would be: exposing an ABI but leaving out well-defined parts of that ABI is essentially failing to expose that ABI.</p>



<a name="180784943"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180784943" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> centril <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180784943">(Nov 14 2019 at 22:56)</a>:</h4>
<p>I don't see why "ABI with restrictions" is illegitimate</p>



<a name="180785097"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180785097" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> BatmanAoD (Kyle Strand) <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180785097">(Nov 14 2019 at 22:57)</a>:</h4>
<p>Well, partly I would say it fails the principle of least surprise, especially if the mechanism for specifying the ABI gives no indication that the ABI isn't fully supported.</p>



<a name="180785213"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180785213" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> centril <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180785213">(Nov 14 2019 at 22:58)</a>:</h4>
<p>that's one consideration</p>



<a name="180785218"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180785218" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> BatmanAoD (Kyle Strand) <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180785218">(Nov 14 2019 at 22:58)</a>:</h4>
<p>I.e. if the ABI string were <code>itanium</code>, where exceptions are <em>definitely</em> well defined (per the spec), one would expect that ABI to support exceptions.</p>



<a name="180785282"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180785282" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> centril <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180785282">(Nov 14 2019 at 22:59)</a>:</h4>
<p>well in this case the ABI string is different</p>



<a name="180785384"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180785384" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> BatmanAoD (Kyle Strand) <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180785384">(Nov 14 2019 at 23:00)</a>:</h4>
<p>Another is the one that <span class="user-mention" data-user-id="132920">@gnzlbg</span> has been expressing, i.e., there's an appropriate way to restrict behavior/effects, but doing so via "ABIs with restrictions" is in some way suboptimal. (I don't want to try to paraphrase the reasoning here.)</p>



<a name="180785420"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180785420" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> BatmanAoD (Kyle Strand) <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180785420">(Nov 14 2019 at 23:00)</a>:</h4>
<p>The main ABI string we're concerned about is <code>extern "C"</code>, though. The ABI string is not different.</p>



<a name="180785480"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180785480" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> centril <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180785480">(Nov 14 2019 at 23:01)</a>:</h4>
<p>I'm familiar with their concerns re. effects <span aria-label="slight smile" class="emoji emoji-1f642" role="img" title="slight smile">:slight_smile:</span></p>



<a name="180785528"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180785528" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> BatmanAoD (Kyle Strand) <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180785528">(Nov 14 2019 at 23:01)</a>:</h4>
<p>There's sort of a "strong objection" to "ABI with restrictions", which is that they shouldn't exist <em>at all</em>; it sounds to me like Nick (the originator of the "sandbox" quote) is in this camp.</p>
<p>Then, there's a "weak objection", which is that "ABI with restrictions" is valid but must be explicit.</p>



<a name="180785674"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180785674" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> BatmanAoD (Kyle Strand) <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180785674">(Nov 14 2019 at 23:03)</a>:</h4>
<p>I'm not sure how much my personal opinion on the issue matters, but just so you know where I stand at the moment: I definitely agree with the "weak objection" stance that FFI mechanisms shouldn't implicitly disable well-defined parts of an ABI; I am currently on the fence with regard to the "strong objection" that e.g. <code>extern "C nounwind"</code> is illegitimate.</p>



<a name="180785782"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180785782" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> centril <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180785782">(Nov 14 2019 at 23:04)</a>:</h4>
<p>That much was clear ^^</p>



<a name="180785820"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180785820" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> BatmanAoD (Kyle Strand) <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180785820">(Nov 14 2019 at 23:05)</a>:</h4>
<p>Anyway, the third consideration is that any well-defined part of an ABI is a means of translating program semantics into program behavior. C++ uses exceptions in this way, and somewhere between "most" and "all" ABIs consider this mechanism well-defined.</p>



<a name="180785978"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180785978" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> BatmanAoD (Kyle Strand) <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180785978">(Nov 14 2019 at 23:07)</a>:</h4>
<p>So, suppressing that feature of the ABI potentially changes the semantics of functions called via FFI, in a way that is both silent (e.g. you wouldn't get a warning at compile time or anything like that) and non-enforceable (i.e. the ABI exposed by C++ has no way of indicating whether or not an exception might be thrown).</p>



<a name="180786119"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180786119" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> centril <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180786119">(Nov 14 2019 at 23:09)</a>:</h4>
<p>I'll head off to bed but please do continue your points</p>



<a name="180786241"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180786241" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> BatmanAoD (Kyle Strand) <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180786241">(Nov 14 2019 at 23:10)</a>:</h4>
<p>Fair enough. I think that's all I have.</p>



<a name="180786260"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180786260" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> BatmanAoD (Kyle Strand) <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180786260">(Nov 14 2019 at 23:10)</a>:</h4>
<p>So to summarize (mostly for future reference when I'm writing up a summary later), the objections to "protecting the user from well-defined parts of the ABI" are:</p>
<ul>
<li>principle of least surprise (ABIs are shared between languages; we shouldn't expect them to behave differently between languages)</li>
<li>"this is an implicit effects mechanism"</li>
<li>changes to semantics of foreign languages<p>- silent<br>
- unenforceable</p>
</li>
</ul>



<a name="180786279"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/FFI%20%22change%20behavior%20or%20protect%20the%20caller%22/near/180786279" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> BatmanAoD (Kyle Strand) <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/FFI.20.22change.20behavior.20or.20protect.20the.20caller.22.html#180786279">(Nov 14 2019 at 23:10)</a>:</h4>
<p>Thanks for the discussion!</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>